DongHyeonkaandClaude Opus 5
4864d837f1
Three SAN entries and no wildcard is the constraint that cost something real in B-7, where oauth2-proxy had to borrow Grafana's app2 hostname because a fourth name was not available. The served chain is four deep and verifies, so fullchain.pem is configured rather than the cert.pem mistake that only breaks clients without a cached intermediate. The forced renewal and the reload behaviour could not be measured because sudo on the host asks for a password, the same silent failure first noticed in B-7. nginx reload is graceful by design, but this lab has repeatedly shown that by design is not the same as measured, so it is recorded as untested rather than assumed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
39 lines
1.5 KiB
Plaintext
39 lines
1.5 KiB
Plaintext
=== 현재 인증서 (외부 관측, sudo 불필요) ===
|
|
subject=CN = auth.hyeonworks.com
|
|
issuer=C = US, O = Let's Encrypt, CN = YE2
|
|
notBefore=Sep 3 00:47:23 2026 GMT
|
|
notAfter=Dec 2 00:47:22 2026 GMT
|
|
X509v3 Subject Alternative Name:
|
|
DNS:app1.hyeonworks.com, DNS:app2.hyeonworks.com, DNS:auth.hyeonworks.com
|
|
|
|
→ 세 호스트가 같은 인증서를 쓴다 (SAN 3개, 와일드카드 아님)
|
|
|
|
=== 체인 완결성 (fullchain vs cert 실수 확인) ===
|
|
0 s:CN = auth.hyeonworks.com
|
|
1 s:C = US, O = Let's Encrypt, CN = YE2
|
|
2 s:C = US, O = ISRG, CN = Root YE
|
|
3 s:C = US, O = Internet Security Research Group, CN = ISRG Root X2
|
|
Verify return code: 0 (ok)
|
|
|
|
→ 중간 인증서가 함께 제공된다. fullchain.pem 이 올바로 설정되어 있다.
|
|
|
|
=== 갱신 자동화 ===
|
|
NEXT LEFT LAST PASSED UNIT
|
|
Fri 2026-09-04 17:03:46 KST 1h 54min Fri 2026-09-04 03:19:39 KST 11h ago certbot-renew.timer
|
|
타이머 enabled: enabled
|
|
타이머 active: active
|
|
|
|
=== 남은 기간 ===
|
|
만료: Dec 2 00:47:22 2026 GMT
|
|
남은 일수: 88일
|
|
Let's Encrypt 90일 발급 · 30일 남으면 갱신 → 실제 갱신까지 약 58일
|
|
|
|
=== 강제 갱신은 하지 못했다 ===
|
|
$ sudo -n -l
|
|
sudo: a password is required
|
|
$ sudo -n systemctl reload nginx
|
|
sudo: a password is required
|
|
|
|
→ test-server 의 sudo 는 비밀번호를 요구한다 (게스트 kc-lab-1/2 는 무암호).
|
|
certbot renew --force-renewal 도 nginx reload 도 실행할 수 없다.
|